ops/homelab
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Activity

chore(deps): update helm release open-webui to v17 #158

Open
renovate-bot wants to merge 1 commit from renovate/open-webui-17.x into main
pull from: renovate/open-webui-17.x
merge into: ops:main
Conversation 1 Commits 1 Files changed 1 +1 -1
renovate-bot commented 2026-10-11 00:13:21 +00:00
Member
Copy link

This PR contains the following updates:

Package Update Change
open-webui (source) major 15.2.0 → 17.0.0

Release Notes

open-webui/helm-charts (open-webui)

v17.0.0

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.6.0

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.5.0

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.4.0

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.3.4

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.3.3

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.3.2

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.3.1

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.3.0

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.2.0

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.1.0

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v16.0.0

Compare Source

Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋

v15.2.1

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [open-webui](https://www.openwebui.com/) ([source](https://github.com/open-webui/helm-charts)) | major | `15.2.0` → `17.0.0` | --- ### Release Notes <details> <summary>open-webui/helm-charts (open-webui)</summary> ### [`v17.0.0`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-17.0.0) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.6.0...open-webui-17.0.0) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.6.0`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.6.0) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.5.0...open-webui-16.6.0) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.5.0`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.5.0) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.4.0...open-webui-16.5.0) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.4.0`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.4.0) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.3.4...open-webui-16.4.0) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.3.4`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.3.4) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.3.3...open-webui-16.3.4) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.3.3`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.3.3) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.3.2...open-webui-16.3.3) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.3.2`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.3.2) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.3.1...open-webui-16.3.2) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.3.1`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.3.1) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.3.0...open-webui-16.3.1) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.3.0`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.3.0) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.2.0...open-webui-16.3.0) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.2.0`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.2.0) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.1.0...open-webui-16.2.0) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.1.0`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.1.0) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-16.0.0...open-webui-16.1.0) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v16.0.0`](https://github.com/open-webui/helm-charts/releases/tag/open-webui-16.0.0) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-15.2.1...open-webui-16.0.0) Open WebUI: A User-Friendly Web Interface for Chat Interactions 👋 ### [`v15.2.1`](https://github.com/open-webui/helm-charts/compare/open-webui-15.2.0...open-webui-15.2.1) [Compare Source](https://github.com/open-webui/helm-charts/compare/open-webui-15.2.0...open-webui-15.2.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTMuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI1My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
chore(deps): update helm release open-webui to v17
All checks were successful
ci/crow/push/dns-test Pipeline was successful
Details
ci/crow/pr/dns-test Pipeline was successful
Details
ci/crow/push/tanka-test Pipeline was successful
Details
ci/crow/pr/tanka-test Pipeline was successful
Details
ci/crow/pr/tanka-diff Pipeline was successful
Details
d9602401af
ci-bot commented 2026-10-11 00:16:19 +00:00
Member
Copy link

flate diff

data.gitlab-exporter.yml.erb  (v1/ConfigMap/gitlab/gitlab-gitlab-exporter)
  ± value change in multiline text (no inserts, one deletion)
      server:
        name: webrick
        listen_address: "*"
        listen_port: 9168
      
      [27 lines unchanged)]
      
            - probe_retries
            - probe_stats
          opts:
            redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
    -       
            redis_enable_client: false
            probe_non_namespaced: true
      
        ruby: &ruby
      
      [19 lines unchanged)]
      
            <<: *db_common
          pg_sequences:
            class_name: Database::PgSequencesProber
            <<: *db_common
  
  

data  (v1/ConfigMap/gitlab/gitlab-migrations)
  + one map entry added:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (no inserts, one deletion)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    -   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (one insert, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
  
  

data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (no inserts, three deletions)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [43 lines unchanged)]
      
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
    -   dependency_proxy:
    -     enabled: true
        gitaly:
          client_path: /home/git/gitaly/bin
    -     client_max_attempts: 4
    -     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [five lines unchanged)]
      
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
    -   gravatar:
    -     plain_url: 
    -     ssl_url: 
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (no inserts, one deletion)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    -   
        id:
  
  

data  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  + one map entry added:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (no inserts, one deletion)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    -   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (one insert, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
  
  

data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (one insert, two deletions)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [157 lines unchanged)]
      
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
    -     client_max_attempts: 4
    -     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [ten lines unchanged)]
      
          
        
        
        
    -   
    -   iam_auth_service:
    -     enabled: false
    -     secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
    -     http:
    -       host: ""
    -       port: 0
    -     grpc:
    -       host: ""
    -       port: 0
    -     jwt_audience: "gitlab-rails"
    +   # Zoekt secrets are present, load them.
    +   zoekt:
    +     username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
    +     password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
      
      [16 lines unchanged)]
      
            enabled: true
            address: "*"
            port: 3808
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (no inserts, one deletion)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    -   
        id:
  
  

data  (v1/ConfigMap/gitlab/gitlab-toolbox)
  + one map entry added:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (no inserts, one deletion)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    -   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (one insert, two deletions)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
      
    - 
    - # Mount point for registry DB secrets. Needs to be pre-created as later the
    - # volume is remounted read-only
    - mkdir "/${secret_dir}/registry-db/"
      if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then
      cat <<EOF > "/${secret_dir}/.s3cfg"
      [default]
      access_key = $(cat /init-secrets/minio/accesskey)
      
      [17 lines unchanged)]
      
      EOF
      else
        mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg"
      fi
  
  

data.configure-gsutil  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (one insert, one deletion)
      if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then
        # The following script is used to configure gsutil when creating backups
        # It provides inputs to the `gsutil config -e` prompt as follows:
        # 1) Path to service account JSON key file

      [four lines unchanged)]

      else
        # If the backup config is not configured, assume that
        # Application Default Credentials are used with a service account.
        # This enables GKE Workload Identity Federation to work.
    -   printf '[GoogleCompute]\nservice_account = default\n' > ~/.boto
    +   echo '[GoogleCompute]\nservice_account = default' > ~/.boto
      fi


data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (one insert, three deletions)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [22 lines unchanged)]
      
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
    -   gravatar:
    -     plain_url: 
    -     ssl_url: 
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
      
      [105 lines unchanged)]
      
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
    -     client_max_attempts: 4
    -     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [ten lines unchanged)]
      
          
        
        
        
    -   
    -   iam_auth_service:
    -     enabled: false
    -     secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
    -     http:
    -       host: ""
    -       port: 0
    -     grpc:
    -       host: ""
    -       port: 0
    -     jwt_audience: "gitlab-rails"
    +   # Zoekt secrets are present, load them.
    +   zoekt:
    +     username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
    +     password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
      
      [nine lines unchanged)]
      
            - 127.0.0.0/8
          sidekiq_exporter:
        extra:
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (no inserts, one deletion)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    -   
        id:
  
  

data  (v1/ConfigMap/gitlab/gitlab-webservice)
  + one map entry added:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (no inserts, one deletion)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    -   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (one insert, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
  
  

data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (one insert, two deletions)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [148 lines unchanged)]
      
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
    -     client_max_attempts: 4
    -     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [ten lines unchanged)]
      
          
        
        
        
    -   
    -   iam_auth_service:
    -     enabled: false
    -     secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
    -     http:
    -       host: ""
    -       port: 0
    -     grpc:
    -       host: ""
    -       port: 0
    -     jwt_audience: "gitlab-rails"
    +   # Zoekt secrets are present, load them.
    +   zoekt:
    +     username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
    +     password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
      
      [33 lines unchanged)]
      
          client_certificate_required_port: 443
          san_extensions: false
          required_for_git_access: false
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (no inserts, one deletion)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    -   
        id:
  
  

data.workhorse-config.toml.tpl  (v1/ConfigMap/gitlab/gitlab-workhorse-default)
  ± value change in multiline text (one insert, one deletion)
      shutdown_timeout = "61s"
      [redis]
      DB = 0
      URL = "redis://gitlab-redis-master.gitlab.svc:6379"
      Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %}
    - {%- $supported_providers := coll.Slice "AWS" "AzureRM" "Google" -%}
    + {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%}
      {%- $connection := coll.Dict "provider" "" -%}
      {%- if file.Exists "/etc/gitlab/minio/accesskey" %}
        {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%}
        {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%}
      
      [29 lines unchanged)]
      
      max_filesize = 250000
      [[listeners]]
      network = "tcp"
      addr = ":8181"
  
  

data.gitlabChartVersion  (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info)
  ± value change
    - 9.11.13
    + 9.8.2

data.gitlabVersion  (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info)
  ± value change
    - 18.11.12
    + 18.8.2

spec.template.spec.containers.gitlab-gitlab-runner.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-runner)
  ± value change
    - registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.11.2
    + registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2

spec.template.spec.containers.gitlab-exporter.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.7.0
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2

spec.template.spec.containers.gitlab-shell.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.50.0
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2

spec.template.spec.containers.kas.image  (apps/v1/Deployment/gitlab/gitlab-kas)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-kas)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2

spec.template.spec.containers.sidekiq.env  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  - one list entry removed:
    - name: GITLAB_SIDEKIQ_MAX_REPLICAS
      value: "10"

spec.template.spec.containers.sidekiq.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2

spec.template.spec.initContainers.dependencies.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2

spec.template.spec.volumes.init-sidekiq-secrets.projected.sources  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  + one list entry added:
    - secret:
        name: gitlab-zoekt-basicauth
        optional: true
        items:
        - key: gitlab_username
          path: zoekt/.gitlab_zoekt_username
        - key: gitlab_password
          path: zoekt/.gitlab_zoekt_password

spec.template.spec.containers.toolbox.image  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2

spec.template.spec.containers.toolbox.volumeMounts  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  - one list entry removed:
    - name: registry-db-config
      mountPath: /etc/gitlab/registry-db/
      readOnly: true

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2

spec.template.spec.volumes  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  - one list entry removed:
    - name: registry-db-config
      projected:
        defaultMode: 288
        sources:
        - configMap:
            name: gitlab-registry-db-connection-config
            optional: true
            items:
            - key: db-connection.env
              path: connection.env
        - configMap:
            name: gitlab-toolbox-registry-db-backuprestore-users
            optional: true
            items:
            - key: backup-user
              path: backup-user.env
            - key: restore-user
              path: restore-user.env
        - secret:
            name: gitlab-toolbox-registry-database-password
            optional: true
            items:
            - key: backupPassword
              path: backup-pass
            - key: restorePassword
              path: restore-pass

spec.template.spec.volumes.init-toolbox-secrets.projected.sources  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  + one list entry added:
    - secret:
        name: gitlab-zoekt-basicauth
        optional: true
        items:
        - key: gitlab_username
          path: zoekt/.gitlab_zoekt_username
        - key: gitlab_password
          path: zoekt/.gitlab_zoekt_password

spec.template.spec.containers.webservice.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2

spec.template.spec.containers.gitlab-workhorse.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2

spec.template.spec.initContainers.dependencies.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2

spec.template.spec.volumes.init-webservice-secrets.projected.sources  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  + one list entry added:
    - secret:
        name: gitlab-zoekt-basicauth
        optional: true
        items:
        - key: gitlab_username
          path: zoekt/.gitlab_zoekt_username
        - key: gitlab_password
          path: zoekt/.gitlab_zoekt_password

spec.template.spec.containers.registry.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab
  

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2

spec.template.spec.initContainers.dependencies.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab
  

spec.template.spec.containers.gitaly.image  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2

spec.template.spec.initContainers.certificates.image  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2

spec.template.spec.initContainers.configure.image  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2

spec.jobTemplate.spec.template.spec.containers.toolbox-backup.image  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2

spec.jobTemplate.spec.template.spec.containers.toolbox-backup.volumeMounts  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  - one list entry removed:
    - name: registry-db-config
      mountPath: /etc/gitlab/registry-db/
      readOnly: true

spec.jobTemplate.spec.template.spec.initContainers.certificates.image  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2

spec.jobTemplate.spec.template.spec.initContainers.configure.image  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2

spec.jobTemplate.spec.template.spec.volumes  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  - one list entry removed:
    - name: registry-db-config
      projected:
        defaultMode: 288
        sources:
        - configMap:
            name: gitlab-registry-db-connection-config
            optional: true
            items:
            - key: db-connection.env
              path: connection.env
        - configMap:
            name: gitlab-toolbox-registry-db-backuprestore-users
            optional: true
            items:
            - key: backup-user
              path: backup-user.env
            - key: restore-user
              path: restore-user.env
        - secret:
            name: gitlab-toolbox-registry-database-password
            optional: true
            items:
            - key: backupPassword
              path: backup-pass
            - key: restorePassword
              path: restore-pass

data.generate-secrets  (v1/ConfigMap/gitlab/gitlab-shared-secrets)
  ± value change in multiline text (one insert, one deletion)
      # vim: set filetype=sh:
      
      namespace=gitlab
      release=gitlab
      
      [34 lines unchanged)]
      
          secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
      
        kubectl --namespace=$namespace label \
          --overwrite \
    -     secret $secret_name app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
    +     secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
      }
      
      # Args: secretname, args
      function generate_secret_if_needed(){
      
      [157 lines unchanged)]
      
      generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0)
      
      # Container Registry notification_secret
      generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"]
  
  

data.runcheck  (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check)
  ± value change in multiline text (one insert, one deletion)
      #!/bin/sh
      
      set -e
      
      
      [29 lines unchanged)]
      
            exit 1
          fi
        fi
      fi
    - MIN_VERSION=18.8
    - CHART_MIN_VERSION=9.8
    + MIN_VERSION=18.5
    + CHART_MIN_VERSION=9.5
      
      # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions)
      GITLAB_VERSION=${GITLAB_VERSION#v}
      
      
      [38 lines unchanged)]
      
          notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}."
        fi
        exit 1
      fi
  
  

spec.template.spec.containers.run-check.env.GITLAB_VERSION.value  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
  ± value change
    - 18.11.12
    + 18.8.2

spec.template.spec.containers.run-check.env.CHART_VERSION.value  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
  ± value change
    - 9.11.13
    + 9.8.2

spec.template.spec.containers.run-check.image  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2

spec.template.spec.containers.open-webui.image  (apps/v1/Deployment/local-ai/open-webui)
  ± value change
    - ghcr.io/open-webui/open-webui:0.10.2
    + ghcr.io/open-webui/open-webui:0.12.0

spec.template.spec.initContainers.copy-app-data.image  (apps/v1/Deployment/local-ai/open-webui)
  ± value change
    - ghcr.io/open-webui/open-webui:0.10.2
    + ghcr.io/open-webui/open-webui:0.12.0

(root level)  (v1/ConfigMap/gitlab/gitlab-registry-db-connection-config)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-registry-db-connection-config
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    db-connection.env: |
      REGISTRY_DATABASE_HOST="db-gitlab-rw.gitlab.svc"
      REGISTRY_DATABASE_PORT="5432"
      REGISTRY_DATABASE_NAME="gl-registry"
      REGISTRY_DATABASE_SSLMODE="disable"

(root level)  (batch/v1/Job/gitlab/gitlab-migrations-d559a5f)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-migrations-d559a5f
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: migrations
          heritage: Helm
          release: gitlab
      spec:
        automountServiceAccountToken: false
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12"
          args:
          - /bin/bash
          - "-c"
          - |
            set -e;
            /scripts/wait-for-deps;
            /scripts/db-migrate;
                                
            
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
          - name: migrations-config
            mountPath: /var/opt/gitlab/templates
          - name: migrations-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/initial_root_password
            subPath: migrations/initial_root_password
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token
            subPath: migrations/gitlab_shared_runners_registration_token
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: migrations-config
            mountPath: /config
            readOnly: true
          - name: init-migrations-secrets
            mountPath: /init-config
            readOnly: true
          - name: migrations-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: migrations-config
          configMap:
            name: gitlab-migrations
        - name: init-migrations-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: gitlab-gitlab-initial-root-password
                items:
                - key: password
                  path: migrations/initial_root_password
            - secret:
                name: gitlab-gitlab-runner-secret
                optional: true
                items:
                - key: runner-registration-token
                  path: migrations/gitlab_shared_runners_registration_token
        - name: migrations-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-registry-migrations-46dd770)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-registry-migrations-46dd770
    namespace: gitlab
    labels:
      app: registry-migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: registry-migrations
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab"
          args:
          - /scripts/wait-for-deps
          - /scripts/db-migrate
          env:
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: migrations-config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
                items:
                - key: configure
                  path: configure
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-28d9d92
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12"
          command:
          - /bin/bash
          - /scripts/generate-secrets
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: scripts
            mountPath: /scripts
          - name: ssh
            mountPath: /etc/ssh
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: scripts
          configMap:
            name: gitlab-shared-secrets
        - name: ssh
          emptyDir: {}

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92-selfsign)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-28d9d92-selfsign
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: kubectl
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12"
          command:
          - /bin/bash
          - "-exc"
          - |
            certname=gitlab-wildcard-tls
            # create wildcard certificate secret
            kubectl create secret tls $certname \
              --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true
            kubectl --namespace=$namespace label \
              secret $certname  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret $certname app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            # create CA certificate secret
            kubectl create secret generic ${certname}-ca \
              --from-file=cfssl_ca=/output/ca.pem || true
            kubectl --namespace=$namespace label \
              secret ${certname}-ca  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-ca app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            # create certificate chain for GitLab Runner
            cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt
            kubectl create secret generic ${certname}-chain \
              --from-file=/tmp/code.nogweii.net.crt || true
            kubectl --namespace=$namespace label \
              secret ${certname}-chain  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-chain app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        initContainers:
        - name: cfssl-self-sign
          image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.11.12"
          env:
          - name: CA_SUBJECT
            value: "GitLab Helm Chart"
          - name: CA_ORG
            value: gitlab
          - name: CA_ORG_UNIT
            value: gitlab
          - name: CERT_SUBJECT
            value: code.nogweii.net
          - name: CERT_DOMAIN
            value: code.nogweii.net
          - name: EXPIRY
            value: 3650d
          - name: ALGORITHM
            value: rsa
          - name: KEY_SIZE
            value: "4096"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: certs-path
          emptyDir: {}
  


(root level)  (batch/v1/Job/gitlab/gitlab-migrations-c0164a8)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-migrations-c0164a8
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: migrations
          heritage: Helm
          release: gitlab
      spec:
        automountServiceAccountToken: false
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
          args:
          - /bin/bash
          - "-c"
          - |
            set -e;
            /scripts/wait-for-deps;
            /scripts/db-migrate;
                                
            
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
          - name: migrations-config
            mountPath: /var/opt/gitlab/templates
          - name: migrations-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/initial_root_password
            subPath: migrations/initial_root_password
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token
            subPath: migrations/gitlab_shared_runners_registration_token
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: migrations-config
            mountPath: /config
            readOnly: true
          - name: init-migrations-secrets
            mountPath: /init-config
            readOnly: true
          - name: migrations-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: migrations-config
          configMap:
            name: gitlab-migrations
        - name: init-migrations-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: gitlab-gitlab-initial-root-password
                items:
                - key: password
                  path: migrations/initial_root_password
            - secret:
                name: gitlab-gitlab-runner-secret
                optional: true
                items:
                - key: runner-registration-token
                  path: migrations/gitlab_shared_runners_registration_token
        - name: migrations-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-registry-migrations-8e2a9a9)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-registry-migrations-8e2a9a9
    namespace: gitlab
    labels:
      app: registry-migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: registry-migrations
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          args:
          - /scripts/wait-for-deps
          - /scripts/db-migrate
          env:
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: migrations-config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
                items:
                - key: configure
                  path: configure
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - /scripts/generate-secrets
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: scripts
            mountPath: /scripts
          - name: ssh
            mountPath: /etc/ssh
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: scripts
          configMap:
            name: gitlab-shared-secrets
        - name: ssh
          emptyDir: {}

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130-selfsign)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130-selfsign
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: kubectl
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - "-exc"
          - |
            certname=gitlab-wildcard-tls
            # create wildcard certificate secret
            kubectl create secret tls $certname \
              --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true
            kubectl --namespace=$namespace label \
              secret $certname  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create CA certificate secret
            kubectl create secret generic ${certname}-ca \
              --from-file=cfssl_ca=/output/ca.pem || true
            kubectl --namespace=$namespace label \
              secret ${certname}-ca  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create certificate chain for GitLab Runner
            cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt
            kubectl create secret generic ${certname}-chain \
              --from-file=/tmp/code.nogweii.net.crt || true
            kubectl --namespace=$namespace label \
              secret ${certname}-chain  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        initContainers:
        - name: cfssl-self-sign
          image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2"
          env:
          - name: CA_SUBJECT
            value: "GitLab Helm Chart"
          - name: CA_ORG
            value: gitlab
          - name: CA_ORG_UNIT
            value: gitlab
          - name: CERT_SUBJECT
            value: code.nogweii.net
          - name: CERT_DOMAIN
            value: code.nogweii.net
          - name: EXPIRY
            value: 3650d
          - name: ALGORITHM
            value: rsa
          - name: KEY_SIZE
            value: "4096"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: certs-path
          emptyDir: {}

Pipeline

## flate diff ``` data.gitlab-exporter.yml.erb (v1/ConfigMap/gitlab/gitlab-gitlab-exporter) ± value change in multiline text (no inserts, one deletion) server: name: webrick listen_address: "*" listen_port: 9168 [27 lines unchanged)] - probe_retries - probe_stats opts: redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 - redis_enable_client: false probe_non_namespaced: true ruby: &ruby [19 lines unchanged)] <<: *db_common pg_sequences: class_name: Database::PgSequencesProber <<: *db_common data (v1/ConfigMap/gitlab/gitlab-migrations) + one map entry added: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (no inserts, one deletion) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 - id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (one insert, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (no inserts, three deletions) production: &base gitlab: host: code.nogweii.net https: true [43 lines unchanged)] terraform_state: enabled: true ci_secure_files: enabled: true - dependency_proxy: - enabled: true gitaly: client_path: /home/git/gitaly/bin - client_max_attempts: 4 - client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [five lines unchanged)] log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 - gravatar: - plain_url: - ssl_url: data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (no inserts, one deletion) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 - id: data (v1/ConfigMap/gitlab/gitlab-sidekiq) + one map entry added: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (no inserts, one deletion) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 - id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (one insert, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (one insert, two deletions) production: &base gitlab: host: code.nogweii.net https: true [157 lines unchanged)] secret_key: shared: gitaly: client_path: /home/git/gitaly/bin - client_max_attempts: 4 - client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [ten lines unchanged)] - - iam_auth_service: - enabled: false - secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret - http: - host: "" - port: 0 - grpc: - host: "" - port: 0 - jwt_audience: "gitlab-rails" + # Zoekt secrets are present, load them. + zoekt: + username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username + password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true [16 lines unchanged)] enabled: true address: "*" port: 3808 data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (no inserts, one deletion) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 - id: data (v1/ConfigMap/gitlab/gitlab-toolbox) + one map entry added: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (no inserts, one deletion) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 - id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (one insert, two deletions) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets - - # Mount point for registry DB secrets. Needs to be pre-created as later the - # volume is remounted read-only - mkdir "/${secret_dir}/registry-db/" if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then cat <<EOF > "/${secret_dir}/.s3cfg" [default] access_key = $(cat /init-secrets/minio/accesskey) [17 lines unchanged)] EOF else mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg" fi data.configure-gsutil (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (one insert, one deletion) if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then # The following script is used to configure gsutil when creating backups # It provides inputs to the `gsutil config -e` prompt as follows: # 1) Path to service account JSON key file [four lines unchanged)] else # If the backup config is not configured, assume that # Application Default Credentials are used with a service account. # This enables GKE Workload Identity Federation to work. - printf '[GoogleCompute]\nservice_account = default\n' > ~/.boto + echo '[GoogleCompute]\nservice_account = default' > ~/.boto fi data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (one insert, three deletions) production: &base gitlab: host: code.nogweii.net https: true [22 lines unchanged)] email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" - gravatar: - plain_url: - ssl_url: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true [105 lines unchanged)] secret_key: shared: gitaly: client_path: /home/git/gitaly/bin - client_max_attempts: 4 - client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [ten lines unchanged)] - - iam_auth_service: - enabled: false - secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret - http: - host: "" - port: 0 - grpc: - host: "" - port: 0 - jwt_audience: "gitlab-rails" + # Zoekt secrets are present, load them. + zoekt: + username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username + password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true [nine lines unchanged)] - 127.0.0.0/8 sidekiq_exporter: extra: data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (no inserts, one deletion) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 - id: data (v1/ConfigMap/gitlab/gitlab-webservice) + one map entry added: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (no inserts, one deletion) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 - id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (one insert, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (one insert, two deletions) production: &base gitlab: host: code.nogweii.net https: true [148 lines unchanged)] secret_key: shared: gitaly: client_path: /home/git/gitaly/bin - client_max_attempts: 4 - client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [ten lines unchanged)] - - iam_auth_service: - enabled: false - secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret - http: - host: "" - port: 0 - grpc: - host: "" - port: 0 - jwt_audience: "gitlab-rails" + # Zoekt secrets are present, load them. + zoekt: + username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username + password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true [33 lines unchanged)] client_certificate_required_port: 443 san_extensions: false required_for_git_access: false data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (no inserts, one deletion) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 - id: data.workhorse-config.toml.tpl (v1/ConfigMap/gitlab/gitlab-workhorse-default) ± value change in multiline text (one insert, one deletion) shutdown_timeout = "61s" [redis] DB = 0 URL = "redis://gitlab-redis-master.gitlab.svc:6379" Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %} - {%- $supported_providers := coll.Slice "AWS" "AzureRM" "Google" -%} + {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%} {%- $connection := coll.Dict "provider" "" -%} {%- if file.Exists "/etc/gitlab/minio/accesskey" %} {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%} {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%} [29 lines unchanged)] max_filesize = 250000 [[listeners]] network = "tcp" addr = ":8181" data.gitlabChartVersion (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info) ± value change - 9.11.13 + 9.8.2 data.gitlabVersion (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info) ± value change - 18.11.12 + 18.8.2 spec.template.spec.containers.gitlab-gitlab-runner.image (apps/v1/Deployment/gitlab/gitlab-gitlab-runner) ± value change - registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.11.2 + registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2 spec.template.spec.containers.gitlab-exporter.image (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.7.0 + registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 spec.template.spec.containers.gitlab-shell.image (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.50.0 + registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 spec.template.spec.containers.kas.image (apps/v1/Deployment/gitlab/gitlab-kas) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-kas) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 spec.template.spec.containers.sidekiq.env (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) - one list entry removed: - name: GITLAB_SIDEKIQ_MAX_REPLICAS value: "10" spec.template.spec.containers.sidekiq.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 spec.template.spec.initContainers.dependencies.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2 spec.template.spec.volumes.init-sidekiq-secrets.projected.sources (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) + one list entry added: - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password spec.template.spec.containers.toolbox.image (apps/v1/Deployment/gitlab/gitlab-toolbox) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2 spec.template.spec.containers.toolbox.volumeMounts (apps/v1/Deployment/gitlab/gitlab-toolbox) - one list entry removed: - name: registry-db-config mountPath: /etc/gitlab/registry-db/ readOnly: true spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-toolbox) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-toolbox) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 spec.template.spec.volumes (apps/v1/Deployment/gitlab/gitlab-toolbox) - one list entry removed: - name: registry-db-config projected: defaultMode: 288 sources: - configMap: name: gitlab-registry-db-connection-config optional: true items: - key: db-connection.env path: connection.env - configMap: name: gitlab-toolbox-registry-db-backuprestore-users optional: true items: - key: backup-user path: backup-user.env - key: restore-user path: restore-user.env - secret: name: gitlab-toolbox-registry-database-password optional: true items: - key: backupPassword path: backup-pass - key: restorePassword path: restore-pass spec.template.spec.volumes.init-toolbox-secrets.projected.sources (apps/v1/Deployment/gitlab/gitlab-toolbox) + one list entry added: - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password spec.template.spec.containers.webservice.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2 spec.template.spec.containers.gitlab-workhorse.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 spec.template.spec.initContainers.dependencies.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2 spec.template.spec.volumes.init-webservice-secrets.projected.sources (apps/v1/Deployment/gitlab/gitlab-webservice-default) + one list entry added: - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password spec.template.spec.containers.registry.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 spec.template.spec.initContainers.dependencies.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab spec.template.spec.containers.gitaly.image (apps/v1/StatefulSet/gitlab/gitlab-gitaly) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2 spec.template.spec.initContainers.certificates.image (apps/v1/StatefulSet/gitlab/gitlab-gitaly) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 spec.template.spec.initContainers.configure.image (apps/v1/StatefulSet/gitlab/gitlab-gitaly) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 spec.jobTemplate.spec.template.spec.containers.toolbox-backup.image (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2 spec.jobTemplate.spec.template.spec.containers.toolbox-backup.volumeMounts (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) - one list entry removed: - name: registry-db-config mountPath: /etc/gitlab/registry-db/ readOnly: true spec.jobTemplate.spec.template.spec.initContainers.certificates.image (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 spec.jobTemplate.spec.template.spec.initContainers.configure.image (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 spec.jobTemplate.spec.template.spec.volumes (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) - one list entry removed: - name: registry-db-config projected: defaultMode: 288 sources: - configMap: name: gitlab-registry-db-connection-config optional: true items: - key: db-connection.env path: connection.env - configMap: name: gitlab-toolbox-registry-db-backuprestore-users optional: true items: - key: backup-user path: backup-user.env - key: restore-user path: restore-user.env - secret: name: gitlab-toolbox-registry-database-password optional: true items: - key: backupPassword path: backup-pass - key: restorePassword path: restore-pass data.generate-secrets (v1/ConfigMap/gitlab/gitlab-shared-secrets) ± value change in multiline text (one insert, one deletion) # vim: set filetype=sh: namespace=gitlab release=gitlab [34 lines unchanged)] secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label \ --overwrite \ - secret $secret_name app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm + secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm } # Args: secretname, args function generate_secret_if_needed(){ [157 lines unchanged)] generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0) # Container Registry notification_secret generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"] data.runcheck (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check) ± value change in multiline text (one insert, one deletion) #!/bin/sh set -e [29 lines unchanged)] exit 1 fi fi fi - MIN_VERSION=18.8 - CHART_MIN_VERSION=9.8 + MIN_VERSION=18.5 + CHART_MIN_VERSION=9.5 # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions) GITLAB_VERSION=${GITLAB_VERSION#v} [38 lines unchanged)] notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}." fi exit 1 fi spec.template.spec.containers.run-check.env.GITLAB_VERSION.value (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) ± value change - 18.11.12 + 18.8.2 spec.template.spec.containers.run-check.env.CHART_VERSION.value (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) ± value change - 9.11.13 + 9.8.2 spec.template.spec.containers.run-check.image (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 spec.template.spec.containers.open-webui.image (apps/v1/Deployment/local-ai/open-webui) ± value change - ghcr.io/open-webui/open-webui:0.10.2 + ghcr.io/open-webui/open-webui:0.12.0 spec.template.spec.initContainers.copy-app-data.image (apps/v1/Deployment/local-ai/open-webui) ± value change - ghcr.io/open-webui/open-webui:0.10.2 + ghcr.io/open-webui/open-webui:0.12.0 (root level) (v1/ConfigMap/gitlab/gitlab-registry-db-connection-config) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-registry-db-connection-config namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: db-connection.env: | REGISTRY_DATABASE_HOST="db-gitlab-rw.gitlab.svc" REGISTRY_DATABASE_PORT="5432" REGISTRY_DATABASE_NAME="gl-registry" REGISTRY_DATABASE_SSLMODE="disable" (root level) (batch/v1/Job/gitlab/gitlab-migrations-d559a5f) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-migrations-d559a5f namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: migrations heritage: Helm release: gitlab spec: automountServiceAccountToken: false containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12" args: - /bin/bash - "-c" - | set -e; /scripts/wait-for-deps; /scripts/db-migrate; env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: BYPASS_SCHEMA_VERSION value: "true" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 250m memory: 200Mi volumeMounts: - name: migrations-config mountPath: /var/opt/gitlab/templates - name: migrations-secrets mountPath: /etc/gitlab readOnly: true - name: migrations-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: migrations-secrets mountPath: /srv/gitlab/config/initial_root_password subPath: migrations/initial_root_password - name: migrations-secrets mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token subPath: migrations/gitlab_shared_runners_registration_token - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: migrations-config mountPath: /config readOnly: true - name: init-migrations-secrets mountPath: /init-config readOnly: true - name: migrations-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: migrations-config configMap: name: gitlab-migrations - name: init-migrations-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: gitlab-gitlab-initial-root-password items: - key: password path: migrations/initial_root_password - secret: name: gitlab-gitlab-runner-secret optional: true items: - key: runner-registration-token path: migrations/gitlab_shared_runners_registration_token - name: migrations-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-registry-migrations-46dd770) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-registry-migrations-46dd770 namespace: gitlab labels: app: registry-migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: registry-migrations heritage: Helm release: gitlab spec: containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab" args: - /scripts/wait-for-deps - /scripts/db-migrate env: - name: BYPASS_SCHEMA_VERSION value: "true" resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: migrations-config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry items: - key: configure path: configure - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-28d9d92 namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: gitlab image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12" command: - /bin/bash - /scripts/generate-secrets resources: requests: cpu: 50m volumeMounts: - name: scripts mountPath: /scripts - name: ssh mountPath: /etc/ssh securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: scripts configMap: name: gitlab-shared-secrets - name: ssh emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92-selfsign) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-28d9d92-selfsign namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: kubectl image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12" command: - /bin/bash - "-exc" - | certname=gitlab-wildcard-tls # create wildcard certificate secret kubectl create secret tls $certname \ --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true kubectl --namespace=$namespace label \ secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret $certname app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm # create CA certificate secret kubectl create secret generic ${certname}-ca \ --from-file=cfssl_ca=/output/ca.pem || true kubectl --namespace=$namespace label \ secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-ca app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm # create certificate chain for GitLab Runner cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt kubectl create secret generic ${certname}-chain \ --from-file=/tmp/code.nogweii.net.crt || true kubectl --namespace=$namespace label \ secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-chain app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output initContainers: - name: cfssl-self-sign image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.11.12" env: - name: CA_SUBJECT value: "GitLab Helm Chart" - name: CA_ORG value: gitlab - name: CA_ORG_UNIT value: gitlab - name: CERT_SUBJECT value: code.nogweii.net - name: CERT_DOMAIN value: code.nogweii.net - name: EXPIRY value: 3650d - name: ALGORITHM value: rsa - name: KEY_SIZE value: "4096" resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: certs-path emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-migrations-c0164a8) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-migrations-c0164a8 namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: migrations heritage: Helm release: gitlab spec: automountServiceAccountToken: false containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - | set -e; /scripts/wait-for-deps; /scripts/db-migrate; env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: BYPASS_SCHEMA_VERSION value: "true" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 250m memory: 200Mi volumeMounts: - name: migrations-config mountPath: /var/opt/gitlab/templates - name: migrations-secrets mountPath: /etc/gitlab readOnly: true - name: migrations-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: migrations-secrets mountPath: /srv/gitlab/config/initial_root_password subPath: migrations/initial_root_password - name: migrations-secrets mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token subPath: migrations/gitlab_shared_runners_registration_token - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: migrations-config mountPath: /config readOnly: true - name: init-migrations-secrets mountPath: /init-config readOnly: true - name: migrations-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: migrations-config configMap: name: gitlab-migrations - name: init-migrations-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: gitlab-gitlab-initial-root-password items: - key: password path: migrations/initial_root_password - secret: name: gitlab-gitlab-runner-secret optional: true items: - key: runner-registration-token path: migrations/gitlab_shared_runners_registration_token - name: migrations-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-registry-migrations-8e2a9a9) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-registry-migrations-8e2a9a9 namespace: gitlab labels: app: registry-migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: registry-migrations heritage: Helm release: gitlab spec: containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" args: - /scripts/wait-for-deps - /scripts/db-migrate env: - name: BYPASS_SCHEMA_VERSION value: "true" resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: migrations-config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry items: - key: configure path: configure - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130 namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: gitlab image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - /scripts/generate-secrets resources: requests: cpu: 50m volumeMounts: - name: scripts mountPath: /scripts - name: ssh mountPath: /etc/ssh securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: scripts configMap: name: gitlab-shared-secrets - name: ssh emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130-selfsign) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130-selfsign namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: kubectl image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - "-exc" - | certname=gitlab-wildcard-tls # create wildcard certificate secret kubectl create secret tls $certname \ --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true kubectl --namespace=$namespace label \ secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create CA certificate secret kubectl create secret generic ${certname}-ca \ --from-file=cfssl_ca=/output/ca.pem || true kubectl --namespace=$namespace label \ secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create certificate chain for GitLab Runner cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt kubectl create secret generic ${certname}-chain \ --from-file=/tmp/code.nogweii.net.crt || true kubectl --namespace=$namespace label \ secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output initContainers: - name: cfssl-self-sign image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2" env: - name: CA_SUBJECT value: "GitLab Helm Chart" - name: CA_ORG value: gitlab - name: CA_ORG_UNIT value: gitlab - name: CERT_SUBJECT value: code.nogweii.net - name: CERT_DOMAIN value: code.nogweii.net - name: EXPIRY value: 3650d - name: ALGORITHM value: rsa - name: KEY_SIZE value: "4096" resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 serviceAccountName: gitlab-shared-secrets volumes: - name: certs-path emptyDir: {} ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/519)
All checks were successful
ci/crow/push/dns-test Pipeline was successful
Details
ci/crow/pr/dns-test Pipeline was successful
Details
ci/crow/push/tanka-test Pipeline was successful
Details
ci/crow/pr/tanka-test Pipeline was successful
Details
ci/crow/pr/tanka-diff Pipeline was successful
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/open-webui-17.x:renovate/open-webui-17.x
git switch renovate/open-webui-17.x

Merge

Merge the changes and update on Forgejo.
git switch main
git merge --no-ff renovate/open-webui-17.x
git switch renovate/open-webui-17.x
git rebase main
git switch main
git merge --ff-only renovate/open-webui-17.x
git switch renovate/open-webui-17.x
git rebase main
git switch main
git merge --no-ff renovate/open-webui-17.x
git switch main
git merge --squash renovate/open-webui-17.x
git switch main
git merge --ff-only renovate/open-webui-17.x
git switch main
git merge renovate/open-webui-17.x
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
ops/homelab!158
No description provided.